Upload media

Outcome

Stores an image in the workspace media library and returns the asset an article can reference.

Before you start

• Verify identity and the intended environment with topolo whoami before selecting an explicitly authorized organization.
• Discover the published workspace:write permission.
• Discover an accessible Blog workspace and set WORKSPACE_ID to that exact returned id. Pass workspace binding separately from action input.
• Review the actual state change and confirm the unchanged plan before execution. Fixture ids and provider responses grant no live authority.

Discover the target

topolo whoami --json
topolo actions get app_topolo_blog.media.upload --detail --json
topolo workspaces list topolo-blog --json

Request

POST /api/media

Inspect parameters and test this action.

Input fields

Worked examples

Documentation source snapshot: TopoloBlog 80d6961207a4ca688b7e9edb947dda720051ad32 (tree 534a285e739a27c1ea9e2c187ce8863824f6c590). The examples retain local fixture captures labeled baseline 2c64c35bf291a47bb3a0c597dcea46ccb47e2a08; their exact executed working tree is not established here. They were not rerun at this documentation snapshot. The production catalog marker topolo.app.json is not a deployed worker revision. Recovery metadata read-back on 18 October 2026 associates the current production Blog API and web deployments with this source through the 17 October release receipt. This establishes applicable deployed source; it does not make these examples current production captures.

Actual exported Blog Worker, local Miniflare D1/R2 and all committed migrations. Auth, Insights, DNS, Cloudflare for SaaS, error reporting, queue and scheduled-workflow boundaries are synthetic and outbound fetch is sealed. No deployed provider, delivery or scheduled execution outcome is established. English examples use the packaged test translation release; article checks and widget labels follow the verified request locale. No live translation release is proved by this fixture.

Save a reviewed input as payload.json. Replace fixture identifiers using discovery in the authorized context.

topolo actions validate app_topolo_blog.media.upload --data @payload.json --json
topolo actions plan app_topolo_blog.media.upload --resource-type workspace --resource-id "$WORKSPACE_ID" --data @payload.json --confirm --json
topolo actions call app_topolo_blog.media.upload --resource-type workspace --resource-id "$WORKSPACE_ID" --data @payload.json --confirm --detail --json

MCP uses the same reviewed input. Replace the synthetic workspace resourceId through discovery when a binding is shown:

{
  "tool": "topolo_prepare_action",
  "arguments": {
    "actionId": "app_topolo_blog.media.upload",
    "input": {
      "fileName": "fixture.png",
      "contentType": "image/png",
      "contentBase64": "iVBORw0KGgo=",
      "altText": "Fixture image"
    },
    "resourceType": "workspace",
    "resourceId": "ws_blog_fixture",
    "confirm": true
  }
}

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_blog.media.upload",
    "input": {
      "fileName": "fixture.png",
      "contentType": "image/png",
      "contentBase64": "iVBORw0KGgo=",
      "altText": "Fixture image"
    },
    "resourceType": "workspace",
    "resourceId": "ws_blog_fixture",
    "confirm": true,
    "detail": true
  }
}

Successful response · HTTP 201

Input · payload.json:

{
  "fileName": "fixture.png",
  "contentType": "image/png",
  "contentBase64": "iVBORw0KGgo=",
  "altText": "Fixture image"
}

Source-reviewed illustration (retained local fixture response; not a current production capture):

{
  "asset": {
    "id": "media_39ef45ba-d5c8-45ca-adce-effe8114cc3e",
    "fileName": "fixture.png",
    "contentType": "image/png",
    "byteSize": 8,
    "altText": "Fixture image",
    "url": "/api/public/media/media_39ef45ba-d5c8-45ca-adce-effe8114cc3e",
    "usageCount": 0,
    "createdAt": "2026-10-06T07:31:34.031Z",
    "updatedAt": "2026-10-06T07:31:34.031Z"
  }
}

Read the returned asset URL and confirm it loads before referencing it in an article.

Successful response · HTTP 201

Input · payload.json:

{
  "fileName": "retained-fixture.png",
  "contentType": "image/png",
  "contentBase64": "iVBORw0KGgo="
}

Source-reviewed illustration (retained local fixture response; not a current production capture):

{
  "asset": {
    "id": "media_c0a142e2-cbbd-42e2-b060-58e0ff7287e1",
    "fileName": "retained-fixture.png",
    "contentType": "image/png",
    "byteSize": 8,
    "altText": "",
    "url": "/api/public/media/media_c0a142e2-cbbd-42e2-b060-58e0ff7287e1",
    "usageCount": 0,
    "createdAt": "2026-10-06T07:31:34.629Z",
    "updatedAt": "2026-10-06T07:31:34.629Z"
  }
}

Read the returned asset URL and confirm it loads before referencing it in an article.

Refused request · HTTP 401 · auth_error

Input · payload.json:

{
  "fileName": "fixture.png",
  "contentType": "image/png",
  "contentBase64": "iVBORw0KGgo=",
  "altText": "Fixture image"
}

Source-reviewed illustration (retained local fixture response; not a current production capture):

{
  "error": "Authentication token required"
}

Sign in again in the intended environment using a valid credential. Preserve the returned handler message; SDK auth_error can represent several authentication refusals.

Verify the result

• Read the returned asset URL and confirm it loads before referencing it in an article.

Errors and recovery

• HTTP 401 · auth_error: Sign in again in the intended environment using a valid credential. Preserve the returned handler message; SDK auth_error can represent several authentication refusals.

Inspect the raw handler error as well as the SDK code. These examples establish observed local refusals, not every possible provider failure.

Recovery boundary

Delete the asset while no article references it.

Related actions

• Create article (app_topolo_blog.articles.create): Create a new draft article in the selected editorial workspace. Always yields a draft: to go live, request review, approve, then publish or schedule.
• Update article (app_topolo_blog.articles.update): Update an article and append an immutable revision. Provided fields replace their previous values (body is replaced whole, not merged), and any edit resets review status to draft.
• Delete media: Permanently delete an unreferenced Blog media asset and its stored object. Deletion is refused while current articles still reference it.

Evidence

Actual exported Blog Worker, local Miniflare D1/R2 and all committed migrations. Auth, Insights, DNS, Cloudflare for SaaS, error reporting, queue and scheduled-workflow boundaries are synthetic and outbound fetch is sealed. No deployed provider, delivery or scheduled execution outcome is established. English examples use the packaged test translation release; article checks and widget labels follow the verified request locale. No live translation release is proved by this fixture.

Documentation history

18 October 2026: Architecture reviewed the retained action guide against the pinned source declaration and named implementation boundaries, qualified local-capture provenance, and prepared paired human and agent amendments. This review does not record a product release, new fixture execution or publication.

2026-10-18: Related guides that cannot yet be published target-first are listed as exact related action references. Captured requests, responses and schemas are unchanged.

2026-10-18: Architecture accepted the paired coauthor delta and qualified the current 80D deployment association from existing Recovery evidence. Examples remain source-reviewed retained-fixture illustrations; no new execution or guide publication is recorded.